1. Who we are
Cairo Goods (“we”, “the platform”) operates the website at cairogoods.com: a marketplace for cars, properties, mobiles and electronics, and job listings, together with an online medical consultation service.
We are the data controller for the personal data described here. For anything in this policy, or to exercise any of the rights in section 8, use our contact page.
2. What we collect
When you create an account: your name, email address, phone number and a password (stored only as a cryptographic hash — we never see or store the password itself). If you sign in with Google, we receive your name, email address and Google account identifier from Google instead of a password.
When you post a listing: everything you choose to put in it — title, description, price, location, photos, and the contact details you want buyers to see. Listing content is public by design.
When you register as a doctor: your name, email, mobile number, gender, specialty, qualifications, professional biography, consultation fees, and a profile photo if you upload one.
When you book a consultation: the doctor, date, time and consultation type, plus anything you write in the comment field. This is health data — the fact that you booked with a particular specialist can reveal information about your health. We treat it as sensitive and restrict access to it accordingly (see section 4).
Automatically, for security: when an administrator performs an action, we log the action, the route, a request identifier, the IP address and the browser user-agent string. This exists to investigate abuse and unauthorised access.
We do not collect: payment card details (see section 5), national ID or passport numbers, precise GPS location, or your contacts.
3. Why we use it, and on what basis
- To run your account and your listings — because it is necessary to provide the service you asked for.
- To arrange consultations between you and a doctor — on the basis of your explicit consent, which you give when you book. You can withdraw it by cancelling.
- To send transactional email — password resets, listing approval or rejection notices, booking confirmations, appointment reminders, and doctor application outcomes. These are part of the service, not marketing.
- To moderate content and investigate abuse — because we have a legitimate interest in keeping the marketplace safe, and a legal obligation to act on unlawful content.
- To keep the platform secure — rate limiting, audit logging and session management.
We do not send marketing email and we do not sell or rent your data to anyone.
4. Who can see what
Public: your approved listings and everything in them, including the contact details you chose to publish. For doctors: name, photo, specialty, qualifications, biography, consultation fees and ratings.
Deliberately not public: a doctor’s email address and mobile number are never shown to patients. Your account email and phone are not shown to other users unless you put them in a listing yourself.
The doctor you book: sees your name and the details of that appointment.
Our administrators: can see account records and listings in order to moderate them. Administrator actions are logged.
If you report a listing, the report is reviewed by an administrator. Your identity is not shown to the person you reported.
5. Who we share it with
We use a small number of service providers, and only for the purposes listed:
- Our hosting provider — stores the database and files that make up the platform.
- Our email provider — delivers the transactional emails listed in section 3.
- Google — only if you choose to sign in with Google, and only to verify that sign-in.
- Stripe — our payment processor for consultation fees. Online payment is not currently enabled, so no payment is being processed today. When it is enabled, card details are entered on Stripe’s own systems and are never sent to or stored by us.
We will also disclose data where we are legally required to, for example in response to a valid order from a competent authority.
There are no advertising networks, analytics services or tracking pixels on this site. We do not run Google Analytics, Meta Pixel or any equivalent.
7. How long we keep it
- Account data — for as long as your account exists, and deleted when you delete it, except where we must keep a record to comply with the law.
- Listings — a published listing expires automatically 60 days after approval.
- Security audit logs — 365 days, then deleted automatically.
- Internal notifications — read notifications are deleted after 90 days.
- Appointment records — kept while the account exists, because both you and the doctor may need the history.
8. Your rights
Under Egypt’s Personal Data Protection Law (Law No. 151 of 2020) you have the right to be told what data we hold about you, to get a copy of it, to have inaccurate data corrected, to have data erased, to withdraw consent where we rely on it, and to object to processing.
You can edit most of your data yourself from your account. For anything else — including erasure and copies — contact us and we will respond within 30 days. We may need to verify your identity first, so that nobody else can make a request in your name.
If you believe we have mishandled your data, you are entitled to complain to the Egyptian Data Protection Centre.
9. How we protect it
Traffic to and from the site is encrypted in transit. Passwords are stored only as hashes. Session tokens are held in cookies that JavaScript cannot read, which limits the damage a malicious script could do. Administrator actions are logged. Uploaded images are checked and processed before being stored.
No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the competent authority as the law requires.
10. Children
The platform is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.
11. Changes to this policy
If we change how we handle personal data, we will update this page and the date at the top. If the change is significant — for example a new category of data, or a new recipient — we will tell account holders by email before it takes effect.
Questions about this document? Contact us.